Technical Field
This application relates to secure, collaborative file sharing across trust boundaries and among different devices and users.
Introduction
It is now quite common for an individual person to use many different types of data processors. Desktop computers and laptops are increasingly augmented and even supplanted by smartphones and tablet computers. Accustomed to using these different client devices to access public information on the World Wide Web, they now find it important to be able to access their own files and private information in the same way. Solutions that use storage servers accessible via File Transfer Protocol (FTP) and other network-based protocols have been used for quite some time for this purpose, as have Web-based file hosting services. More recently, file hosting services that also offer file synchronization across multiple client devices are becoming an increasingly popular way to store computer files. These services allow users to create a special folder on a computer, which the service then synchronizes so that it appears to be the same folder with the same contents regardless of the particular device on which the folder is viewed. Services of this type include Dropbox™, Google™ Drive™, Microsoft™ SkyDrive™, Microsoft SharePoint™ and others. The providers of these services typically offer software for different operating systems such as Microsoft Windows™, Apple™ Mac OSx™, Linux™, Android™, Apple iOS™, Blackberry™ OS™ and web browsers. The popularity of these services is no doubt due to the increasing tendency of each person to use multiple devices such as laptops, desktops, smart phones, tablets, etc. while expecting their information to be available anytime, anywhere.
While these store and sync services have found widespread use and provide many advantages they are not without their shortcomings. One important shortcoming involves security. For example, any user that has been authorized to access another user's Dropbox folder will be granted access to all of the contents of that folder. Therefore, these services provide no easy way to manage security on a per file, or even per-folder, basis. And even if a user tries to make use of passwords to protect individual files, there is still the problem of managing distribution of the password among two or more other people who wish to collaborate on a project.
One solution to provide seamless, secure, private, collaborative file synchronization across trust boundaries was described in U.S. Pat. No. 8,572,757 by Stamos and Odnovorov and assigned to nCrypted Cloud LLC, also incorporated by reference herein. As described in that patent, this is done by storing everything that is needed to recover a protected file within the file itself, without giving away the secret data needed to recover the file, including all information needed to recover the file in the event a password is lost. User-specific personal keys are preferably only stored on the users' device(s). A unique ID is also created for each protected file; a password is generated that depends on (a) a key value that can either be (i) the user's personal key in the case of a file that is to be private or (ii) a shared key in the case of a file that is to be shared with other users, and (b) the unique file ID. The password is then encrypted using a recovery key and also stored in the file itself. The file can be further secured using a format that supports password-based content encryption.